{"id":"GHSA-w28w-gp39-m4p6","title":"Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer","summary":"Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer","severity":"critical","cvss":10,"cwe":["CWE-94","CWE-1336"],"vendor":"prompty","product":"@prompty/core","ecosystem":"npm","affected":["@prompty/core <= 0.1.4","@prompty/core >= 2.0.0-alpha.1, <= 2.0.0-beta.4"],"patched":["@prompty/core 0.1.5","@prompty/core 2.0.0-beta.5"],"published":"2026-07-24","updated":"2026-07-24","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-w28w-gp39-m4p6","references":[{"url":"https://github.com/microsoft/prompty/security/advisories/GHSA-w28w-gp39-m4p6"},{"url":"https://github.com/microsoft/prompty/pull/404"},{"url":"https://github.com/microsoft/prompty/commit/047756f4c8caf91c5868eeb42520c938393277b0"},{"url":"https://github.com/advisories/GHSA-w28w-gp39-m4p6"}],"tags":["ghsa","npm"],"ingestedAt":"2026-07-24T16:33:09.121Z","slug":"GHSA-w28w-gp39-m4p6","body":"## Overview\n\n## Summary\nThe TypeScript Nunjucks renderer evaluated untrusted `.prompty` template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process.\n\n## Affected packages\n- npm `@prompty/core` versions `<= 0.1.4`\n- npm `@prompty/core` versions `<= 2.0.0-beta.4`\n\n## Impact\nApplications that render untrusted, community-supplied, cloned, or LLM-generated `.prompty` files with the TypeScript runtime could allow attacker-controlled code execution with the privileges of the Node.js host process.\n\n## Remediation\nUpgrade to `@prompty/core` `2.0.0-beta.5` or later. The patched renderer sanitizes render inputs to own-data-only values, rejects constructor/prototype member traversal, and disallows template function calls. Ordinary interpolation, conditionals, loops, and own nested data properties remain supported.\n\n## Fix details\nThe fix is merged in PR #404 and includes regression coverage for default Nunjucks rendering, explicit renderer usage, unsafe member lookups, and attempted template function calls.\n\n## Affected packages\n\n- `@prompty/core <= 0.1.4`\n- `@prompty/core >= 2.0.0-alpha.1, <= 2.0.0-beta.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@prompty/core 0.1.5`\n- `@prompty/core 2.0.0-beta.5`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}